Exploitation of Citrix Bleed 2 (CVE-2025-5777) Began Before PoC Was Public
Summary: GreyNoise observed exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler, beginning June 23 - nearly two weeks before a public proof-of-concept was released on July 4. Early attempts came from malicious IPs geolocated in China that targeted GreyNoise sensors emulating NetScaler appliances rather than exploiting indiscriminately, and CISA contacted GreyNoise on July 9 to confirm the activity before the CVE was added to the KEV catalog.
What's compelling: Attackers were working this NetScaler flaw for nearly two weeks before any public proof-of-concept existed, so waiting for a PoC or a KEV listing to prioritize patching leaves a window that has already been used against emulated appliances.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-5777
- Related
- CVE-2025-5777: Citrix Net Scaler ADC and Gateway Out-of-Bounds Read Vulnerability Known Exploited Vulnerabilities · Jul 10, 2025At The Edge Clear: July 20 - 27, 2026 Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026